🏛️ Multi-Sig Governance | Quorum Threshold Checker for WASM Code Upgrades

[ayandipe]

Closes #595

---

Description

Implements N-of-M multi-sig authorization for WASM bytecode upgrades to prevent single-key compromise exploits (Issue #595).

Changes

src/governance.rs

• Added GovernanceConfig struct with configurable quorum_threshold (defaults to 2, matching previous hardcoded behavior)
• Added get_governance_config() / set_governance_config() storage accessors
• Added verify_upgrade_quorum(env, signers) — validates that the provided signer list meets the threshold. Signers are validated against the admin and the SIGNERS_KEY registry
• Added GovernanceUpgradeProposal struct to persist the full signer list
• Added GOVERNANCE_UPGRADE_KEY and GOVERNANCE_CONFIG_KEY storage constants

src/lib.rs

• propose_upgrade(): Now accepts a signers: Vec<Address> parameter, calls verify_upgrade_quorum instead of the old hardcoded require_multisig, stores the full proposal, emits GV_UPG_PROPOSED event
• execute_upgrade(): Loads the stored GovernanceUpgradeProposal and re-verifies quorum at execution time — prevents race conditions where signers are removed between proposal and execution
• cancel_upgrade(): Also cleans up GOVERNANCE_UPGRADE_KEY
• Added set_governance_config(), get_governance_config(), get_governance_upgrade_proposal() public methods

src/test.rs

• Updated all propose_upgrade test calls to include the signers parameter and register the admin as a signer

Technical Requirements Addressed

1. ✅ Track threshold weight and registered administrative signers in storage
2. ✅ Abort upgrade() invocation if collected signature weight is below threshold quorum
3. ✅ Emit GovernanceUpgradeProposed event upon proposal registration